Live › vulnerability › CVE-2026-111639
Go to dashboardbbs-go through 4.4.6 has an authentication bypass in its /api/login/google_one_tap endpoint. Because the endpoint never checks the aud claim of submitted Google ID tokens, an attacker can replay a token issued to their own OAuth client and get a session as the victim's Google-linked account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of bbs-go up to and including 4.4.6 that expose the Google One Tap login endpoint are exposed. Anyone who does not run bbs-go, or runs a version newer than 4.4.6 with the fix applied, can skip it.
No product ranges from the sources yet.
4.4.6/api/login/google_one_tap is reachable on your deployment4.4.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
This page as .md · .json · in your agent: get_signal("CVE-2026-111639")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.